grammar SplunkToMysql;

prog: query;

query: indexTable (pipe allTableFields)? (pipe lookup)? (pipe allTableFields)* (pipe search)? (pipe statsCount)?
 ;

// index eventtype=hids_access_log_per5min
indexTable: (('index' ((indexName)|(indexAlias '=' indexName))) | indexName);
//indexTable: 'index' indexAlias '=' indexName;

allTableFields:  rename | fillnull | tableFields ;
// table _time, src_ip, agent_ip, host_name, uname, count  
tableFields: ('table' fields);
// fillnull value="SRC_NOT_RIS" whitelistStatus
fillnull: 'fillnull' 'value' '=' oneFieldValue oneFieldName;
//  rename agent_ip as dst_ip
rename: 'rename' oneFieldName 'AS' fieldAliasName ;

//lookup ris_src_whitelist2023 ip AS src_ip output explain AS whitelistStatus 
lookup: 'lookup' indexName fieldNameAs fields;

// stats count by src_ip
statsCount: 'stats' 'count' 'by' oneFieldName;

// search src_ip=10.10.* OR src_ip=10.172.* OR src_ip=10.173.* 
search: 'search' condition (conditionMore)*;
condition: oneFieldName '=' oneFieldValue;
conditionMore: OPERATION condition;
OPERATION: AND|OR;



valueStr: IDENTIFIER;
indexName: IDENTIFIER;
indexAlias: IDENTIFIER;
pipe: '\n|';
fields: fieldName (','? fieldName)*;
oneFieldName: IDENTIFIER;
oneFieldValue: ANY;
fieldName: (fieldNameAs | IDENTIFIER);
fieldNameAs: IDENTIFIER ' AS ' fieldAliasName ','?;
fieldAliasName: IDENTIFIER;

IDENTIFIER: [a-zA-Z_][a-zA-Z_0-9]*;
ANY: DQUOTA_STRING | SQUOTA_STRING | BQUOTA_STRING;
NEWLINE: '\r'? '\n' ;
AND: 'AND';
OR: 'OR';
WS: [ \t\r\n]+ -> skip;

fragment DQUOTA_STRING     : '"' ( '\\' . | '""' | ~('"' | '\\'))* '"';
fragment SQUOTA_STRING     : '\'' ('\\' . | '\'\'' | ~('\'' | '\\'))* '\'';
fragment BQUOTA_STRING     : '`' ( ~'`' | '``')* '`';